Everest Forms <= 3.6.2 - Unauthenticated Sensitive Information Exposure via Smart-Tag Injection in Smart-Tag Injection in Form Field Values ({post_meta key=...})

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-91153 · Microsoft / collected KEV context

cve-program · CVE-2026-91153

• https://www.wordfence.com/threat-intel/vulnerabilities/id/b820a342-3aaa-4782-9d82-afe53028b72c?source=cve
• https://plugins.trac.wordpress.org/browser/everest-forms/tags/3.6.1/includes/class-evf-smart-tags.php#L503
• https://plugins.trac.wordpress.org/browser/everest-forms/tags/3.6.1/includes/class-evf-form-task.php#L731
• https://plugins.trac.wordpress.org/browser/everest-forms/tags/3.6.1/includes/class-evf-form-task.php#L261
• https://plugins.trac.wordpress.org/browser/everest-forms/tags/3.6.1/includes/class-evf-ajax.php#L681
• https://plugins.trac.wordpress.org/browser/everest-forms/tags/3.6.1/includes/class-evf-ajax.php#L2342
• https://plugins.trac.wordpress.org/browser/everest-forms/tags/3.6.1/includes/shortcodes/class-evf-shortcode-form.php#L370
• https://github.com/themegrill/everest-forms/pull/1669/changes
• https://plugins.trac.wordpress.org/changeset/3747723/everest-forms/trunk/includes/class-evf-form-task.php